free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler

free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers

free5GC: NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions

free5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions

free5GC: NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions

free5GC: NRF nnrf-nfm lacks NF Profile input validation — enables NF Registration Poisoning with arbitrary service endpoints

free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error

free5GC: PCF Npcf_SMPolicyControl missing authentication middleware allows unauthenticated access to SM policy handlers and disclosure of subscriber SUPI

free5GC: SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutating

free5GC AUSF authentication contexts can be overwritten by concurrent requests for the same SUPI

free5GC: Improper Input Validation and Generation of Error Message Containing Sensitive Information in github.com/free5gc/udm

free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 via nil pointer dereference

free5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-controlled notifyUri)

free5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)

free5GC: NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure due to nil ProblemDetails dereference

free5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflect.Set on incompatible types)

free5GC PCF: Memory Leak via CORS Middleware Registration in HTTP Handler Leads to Denial of Service

free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions

free5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptions

free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions

Free5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication

An issue in Free5GC v.4.2.0 and before allows a remote attacker to cause a denial of service via the function HandleAuthenticationFailure of the component AMF

free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference

free5GC AUSF UE Authentication Panic on Nil SuciSupiMap Interface Conversion

free5GC NRF Discovery EncodeGroupId Function Panics on Malformed group-id-list Parameter

Free5GC PFCP UDP Endpoint denial of service

A heap buffer overflow vulnerability in the UPF component of free5GC v4.0.1 allows remote attackers to cause a denial of service via a crafted PFCP Session Modification Request

An array index out of bounds vulnerability in the AMF component of free5GC v4.0.1 allows remote attackers to cause a denial of service via a crafted 5GS Mobile Identity in a NAS…

An improper input validation and protocol compliance vulnerability in free5GC v4.0.1 allows remote attackers to cause a denial of service

Free5GC SMF SessionDeletionResponse null pointer dereference

Free5GC pfcp_reports.go identityTriggerType null pointer dereference

Free5GC SMF datapath.go ResolveNodeIdToIp denial of service

Free5GC SMF establishPfcpSession null pointer dereference

Free5GC SMF PFCP UDP Endpoint pfcp_reports.go HandleReports denial of service

Free5GC SMF PFCP handler.go HandlePfcpSessionReportRequest denial of service

Free5GC SMF PFCP UDP Endpoint handler.go HandlePfcpAssociationReleaseRequest null pointer dereference

An issue was discovered in function LocalNode.Sess in free5GC 4.1.0 allowing attackers to cause a denial of service or other unspecified impacts via crafted header Local SEID to…

The free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP Session Deletion Requests

An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Nnssf_NSSAIAvailability API

free5gc v4.1.0 and before is vulnerable to Buffer Overflow

Free5gc 4.0.1 is vulnerable to Buffer Overflow

An issue was discovered in free5GC version 3.3.0, allows remote attackers to execute arbitrary code and cause a denial of service (DoS) on AMF component via crafted NGAP message

Buffer Overflow vulnerability in free5gc 3.3.0 allows attackers to cause a denial of service via crafted PFCP messages whose Sequence Number is mutated to overflow bytes

Buffer Overflow vulnerability in free5gc 3.3.0 allows attackers to cause a denial of service via crafted PFCP message with malformed PFCP Heartbeat message whose Recovery Time…

Buffer Overflow vulnerability in free5gc 3.3.0, UPF 1.2.0, and SMF 1.2.0 allows attackers to cause a denial of service via crafted PFCP messages

In Free5gc v3.0.5, the AMF breaks due to malformed NAS messages

Free5gc v3.2.1 is vulnerable to Information disclosure

free5GC: NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path

free5GC: UE Security Capability bypass on NGAP PathSwitchRequest

free5GC: UDR Improper ueId validation in free5GC EE subscription handlers allows arbitrary identifier persistence